CNDA Risk Management and Compliance

Question 1

In risk management, what does the formula Risk = Threat × Vulnerability × Impact represent?

Accepted Answer

A qualitative method for calculating risk exposure based on threat likelihood, exploitability, and business impact

Answer

This formula helps prioritize risks by combining the likelihood of a threat exploiting a vulnerability with the potential business impact.

Question 2

Which risk treatment option involves purchasing cyber insurance to offset potential financial losses?

Accepted Answer

Risk transference

Answer

Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider, without eliminating the risk itself.

Question 3

What US federal law requires federal agencies to implement a risk management framework for information security?

Accepted Answer

FISMA (Federal Information Security Modernization Act)

Answer

FISMA requires federal agencies and contractors to develop, document, and implement information security programs based on NIST frameworks.

Question 4

In the NIST Risk Management Framework (RMF), what is the correct order of the first three steps?

Accepted Answer

Prepare, Categorize, Select

Answer

NIST RMF steps are: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor — Prepare was added in RMF Rev 2.

Question 5

Which compliance framework applies specifically to organizations that process, store, or transmit payment card data?

Accepted Answer

PCI-DSS

Answer

PCI-DSS (Payment Card Industry Data Security Standard) is mandated by card brands for any entity handling cardholder data.

CNDA - Certified Network Defense Architect Practice Test